When the easy way fails – local exploits
Every lab demonstration is going to have certain assumptions built into it. One of the assumptions so far is that Armitage/Metasploit was able to achieve SYSTEM via getsystem. As we learned in our crash course on named pipes, there are defenses against this sort of thing, and we’re often blind when we execute getsystem. It’s always thought of as a mere attempt with no guarantee of results.
Let’s take a look at an example. In this lab computer, we compromised a lowly user account with snatched credentials. After verifying that I’m running as a low-privilege account (called User) with getuid, I background the session and execute search exploits local. This query will search through all exploits with local as a keyword. Before we fire off our chosen local escalation exploit, let’s take a stroll back through kernel land, where the local escalation vulnerability is quite the pest.
